[Snort-users] adding another sensor

James Riden j.riden at ...11179...
Tue Apr 26 14:16:03 EDT 2005


Jason Benway <benwaynet at ...11827...> writes:

> I'm adding my second snort install at one of our remote locations. I
> want to log the snort information back to my local snort install so
> base can see all the information.
> 
> I installed snort and snort-mysql on the remote linux box. Now I'm
> assuming in my snort.conf I set the output to the mysql database on my
> local snot box. Then all the snort data will be in the same database
> and I can view it in base?
> 
> Where in the snort conf to I give the remote sensor a different name?
> 
> thanks,jb

adjust for mysql as appropriate:

output database: log, postgresql, user=snort_db_user dbname=snort password=******* host=<remotehost> sensor_name=<sensorname>
 
cheers,
 Jamie
-- 
James Riden / j.riden at ...11179... / Systems Security Engineer
Information Technology Services, Massey University, NZ.
GPG public key available at: http://www.massey.ac.nz/~jriden/






More information about the Snort-users mailing list